CVE-2014-6053: Medium severity LibVNCServer LibVNCServer vulnerability
Last updated 24 July 2024
Other sources
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
debian/tightvncto a version that resolves this vulnerability.Fixed in 1:1.3.10-3Fixed in 1:1.3.10-7Fixed in 1:1.3.10-9Fixed in 1:1.3.10-11 - Upgrade
Upgrade
debian/vinoto a version that resolves this vulnerability.Fixed in 3.22.0-6 - Upgrade
Upgrade
LibVNCServerto a version that resolves this vulnerability.Fixed in 0.9.9
Event History
Frequently Asked Questions
What is CVE-2014-6053?
CVE-2014-6053 is a vulnerability in LibVNCServer that allows remote attackers to cause a denial of service or memory consumption.
How does the vulnerability in LibVNCServer (CVE-2014-6053) occur?
The vulnerability occurs because the rfbProcessClientNormalMessage function in libvncserver/rfbserver.c does not handle large amounts of ClientCutText data properly.
What is the severity of CVE-2014-6053?
CVE-2014-6053 has a severity level of medium.
Which software versions are affected by CVE-2014-6053?
The vulnerability affects LibVNCServer versions 0.9.9 and earlier.
How can I fix the vulnerability in LibVNCServer (CVE-2014-6053)?
To fix the vulnerability, you should update LibVNCServer to version 0.9.9 or later.